Orchard botnet uses Bitcoin Transaction info to generate DGA domains

guest · Aug 9, 2022

August 8, 2022

360 Netlab researchers recently discovered a new botnet named Orchard that uses Satoshi Nakamoto’s Bitcoin account (1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa) transaction information to generate DGA domain name.

“Another change relates to the use of the DGA algorithm employed in the attacks. While the first two variants exclusively rely on date strings to generate the domain names, the newer version uses balance information obtained from the cryptocurrency wallet address “1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa.” reads the analysis published by the researchers.
“It’s worth pointing out that the wallet address is the miner reward receiving address of the Bitcoin Genesis Block, which occurred on January 3, 2009, and is believed to be held by Nakamoto.”

“Over the past decade or so, small amounts of bitcoin have been transferred to this wallet on a daily basis for various reasons, so it is variable and that change is difficult to predict, so the balance information for this wallet can also be used as DGA input,” the researchers added.
Click to expand...

Because of the uncertainty of Bitcoin transactions, this technique is more unpredictable than using the common time-generated DGAs, and thus more difficult to defend against.

The researchers discovered three versions of this botnet since February 2021, they also noticed that its operators switched programming languages during the same period.
The bot allows operators to deploy additional malware onto the infected machine and execute commands received from the C2 server.
Click to expand...

All the versions analyzed by the experts versions support propagation by infecting USB disks, anyway, experts believe Orchard can be spread in other ways.

Netlab researchers reported that which v1 and v2 have already infected thousands of machines, while v3 is composed of lesser systems because of its late appearance.
Click to expand...

Qihoo 360 Netlab: A new botnet Orchard Generates DGA Domains with Bitcoin Transaction Information

DGA is one of the classic techniques for botnets to hide their C2s, attacker only needs to selectively register a very small number of C2 domains, while for the defenders, it is difficult to determine in advance which domain names will be generated and registered.

The technique was discovered in a family of botnets we called Orchard. Since February 2021, this botnet has gone through 3 versions, and even switched programming languages in between.
Click to expand...

Key points are as follow:

Orchard is a botnet family that uses DGA technology with the core function of installing various malware on the victim's machine.

From February 2021 to the present, we have detected 3 versions of Orchard samples, all using the DGA technique.

Orchard's DGA algorithm has remained unchanged, but the use of dates has been changing, and the latest version also supports the use of bitcoin account information to generate separate DGA domains.

In addition to DGA, Orchard also hardcodes C2 domains.

Orchard is still active and dedicated to Monroe coin mining.

Click to expand...

Log in or Sign up

Orchard botnet uses Bitcoin Transaction info to generate DGA domains

guest Guest

Log in or Sign up

Orchard botnet uses Bitcoin Transaction info to generate DGA domains

guest Guest

Useful Searches